

They had a list of the hidden service addresses that were being targeted by the attack.
They had been watching the Tor-based DDoS.

You're not supposed to know the IP address of a hidden service. (I was stunned.) Tor is supposed to be anonymous. "19 dot" "19 dot" and then they told me the rest of the network address. I read off the address: "152 dot" and they repeated back "152 dot". I asked them if they could help me find the source of the attack. Others are very experienced at tracking down denial-of-service attacks and their associated command-and-control (C&C) servers. Some of these are the people who warn the world about new network attacks. While trying to find creative ways to keep the service up, I consulted a group of friends who are very active in the network incident response field. (The Tor service that I run for the Internet Archive was down for a few hours, but I managed to keep it up and running through most of the attack.) I spent days analyzing the attack, developing mitigation options, and defending my server. Last February, my Tor onion service came under a huge Tor-based distributed denial-of-service (DDoS) attack.
